Re: [Acme] WGLC for ACME DTN Node ID

These changes resolve my concerns.

Russ

> On Apr 9, 2021, at 5:40 PM, Brian Sipos <BSipos@rkf-eng.com> wrote:
> 
> Russ,
> Thank you for the review comments. My responses are inline with prefix "[BS1]".
> 
>> I think that this document is almost ready.  I have a few comments.
> 
>> MAJOR:
> 
>> Section 4 points to Section 4.4.2 of [I-D.ietf-dtn-tcpclv4]; but that profile does not require the certificate to
> include an EKU of id-kp-bundleSecurity.  When this document is used to verify control over the DTN Node ID, I think the
> issued certificate MUST include an EKU of id-kp-bundleSecurity.  If other means are used to validate other identities,
> then other EKU values might be included as well.
> 
> [BS1] This seems reasonable to require. I suppose the "email-reply-00" document [1] just leaves out any discussion of
> EKU because the preexisting S/MIME documents define a more concrete certificate profile and there is a lot of momentum
> behind S/MIME implementation. I'm going to add statements about the EKU in the CSR and the issued certificate.
> 
>> Section 4.2 is talking about S/MIME certificates.  I think there is a cut-and-paste error here.
> 
> [BS1] Yes, these statements should replace "S/MIME" with "bundle security".
> 
>> MINOR:
> 
>> Section 3.1 says:  "The only over-the-wire data required by ACME for a Challenge Bundle is a nonce token ...".  This
> is the first time that "nonce" appears in the document.  Please reword.
> 
> [BS1] I removed this statement and replaced it with a statement about the token-part2 scope:
> The <token-part2> value included in this object is fixed for the entire challenge, and may correspond with multiple
> separate <token-part1> values when multiple Challenge Bundles are sent for a single validation.
> 
>> Section 3.3 and 3.4: in the beginning of the section, please add a pointer to the document that defines these
> parameters.  I think it is draft-ietf-dtn-bpbis.
> 
> [BS1] That is the correct reference. I am adding a statement at the top of each section.
> 
>> Section 6.1: please provide a reference for "BPSEC key material", and please spell out "BCB".
> 
> [BS1] I removed this speculative text and replaced it with:
> It is possible for intermediate BP nodes to encapsulate-and-encrypt Challenge and/or Response Bundles while they
> traverse untrusted networks, but that is a DTN configuration matter outside of the scope of this document.
> 
>> NITS:
> 
>> Section 1: please spell out BP on first use.
>> Section 2: s/wildcard ("*") character/wildcard character ("*")/
>> Section 6.2:  please spell out "BIB".
> 
> [BS1] I am correcting all of these typos.
> 
> 
> [1] https://tools.ietf.org/html/draft-ietf-acme-email-smime-14
> 
> _______________________________________________
> Acme mailing list
> Acme@ietf.org
> https://www.ietf.org/mailman/listinfo/acme